CVE-2026-64851

Name of the Vulnerable Software and Affected Versions Grav Shortcode Core versions prior to 6.2.2

Description Stored cross-site scripting occurs when the plugin processes shortcode syntax through Security::detectXss() without proper encoding. Specifically, ColorShortcode.php and related attribute handlers concatenate attacker-controlled parameters directly into HTML. An account with admin.pages permission can manipulate the generated attribute to add an event handler, allowing the execution of malicious scripts for visitors or administrators viewing the page.

Recommendations Update to version 6.2.2.